Amazon OpenSearch | Notes

Written by Paul Bradley

Notes on using Amazon's OpenSearch the distributed search and analytics suite derived from Elasticsearch

↑OpenSearch

Amazon OpenSearch Service makes it easy for you to perform interactive log analytics, real-time application monitoring, website search, and more. OpenSearch is an open source, distributed search and analytics suite derived from Elasticsearch.

We use logstash, part of the Elastic Stack, to transfer application log files into an OpenSearch index.

↑Removing a write lock on an index

I was recently attempting to upgrade a cluster to the latest 2.3 version. However, the pre-production cluster had become full and OpenSearch had put a write lock on the index to protect the cluster.

As there was insufficient space, the upgrade couldn’t be performed. I needed to purge older documents from the cluster. Before I could do that I needed to remove the write block on the index.

I used the following curl command to remove the write block by setting the value to false. In the examples corestl is the name of the index.

1curl -X PUT \
2     -H "Content-Type: application/json" \
3    https://vpc-cluser-id.region.es.amazonaws.com/corestl/_settings \
4    -d '{"index": {"blocks": {"write": "false"}}}'

↑Deleting records using the delete by query endpoint

With the write block removed, I could then use the delete by query endpoint to delete documents from the index older than the 1st of December 2022. The curl command is shown below:

1curl -X POST \
2     -H "Content-Type: application/json" \
3     -d @delete.json \
4     https://vpc-cluser-id.region.es.amazonaws.com/corestl/_delete_by_query?timeout=5m&refresh=true&conflicts=proceed

The contents of the delete.json file is shown below:

 1{
 2    "query": {
 3        "bool": {
 4            "filter": {
 5                "range": {
 6                    "@timestamp": {
 7                        "lte": "2022-12-01 00:00:00.0",
 8                        "format": "yyyy-MM-dd HH:mm:ss.S" 
 9                    }
10                }
11            }
12        }
13    }
14}

↑Provisioning an OpenSearch Cluster with Terraform

Below is the Terraform template I used to provision the initial OpenSearch Cluster.

 1resource "aws_elasticsearch_domain" "elastic-ihe-logs" {
 2    domain_name           = "elastic-ihe-logs"
 3    elasticsearch_version = "7.10"
 4
 5    cluster_config {
 6        instance_count         = 2
 7        instance_type          = "r5.large.elasticsearch"
 8        zone_awareness_enabled = true
 9    }
10
11    vpc_options {
12        subnet_ids = var.private_subnets
13        security_group_ids = [var.elasticsearch_security_group_id]
14    }
15
16    ebs_options {
17        ebs_enabled = true
18        volume_size = 1000
19        volume_type = "gp2"
20    }
21
22    encrypt_at_rest {
23        enabled = true
24    }
25
26    node_to_node_encryption {
27        enabled  = true
28    }
29
30    domain_endpoint_options {
31        enforce_https = true
32        tls_security_policy = "Policy-Min-TLS-1-2-2019-07"
33    }
34
35    snapshot_options {
36       automated_snapshot_start_hour = 04
37    }
38
39    access_policies = <<POLICY
40{
41  "Version": "2012-10-17",
42  "Statement": [
43    {
44      "Effect": "Allow",
45      "Principal": {
46        "AWS": "*"
47      },
48      "Action": "es:*",
49      "Resource": "arn:aws:es:eu-west-2:XXXXXX:domain/elastic-ihe-logs/*"
50    }
51  ]
52}
53POLICY
54
55}